CVE-2026-4060
Published: 02 May 2026
Summary
CVE-2026-4060 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4060 is a Time-Based SQL Injection vulnerability (CWE-89) in the Geo Mashup plugin for WordPress, affecting all versions up to and including 1.13.18. The flaw stems from insufficient escaping of the user-supplied 'sort' parameter and inadequate preparation in existing SQL queries. Specifically, the esc_sql() function is applied but proves ineffective in the ORDER BY context due to the lack of enclosing quotes. Although version 1.13.18 introduced a whitelist-based sanitize_sort_arg() function, it is only enforced in the AJAX code path via sanitize_query_args(), leaving vulnerabilities in render-map.php and template tag code paths exposed.
Unauthenticated attackers can exploit this remotely with low attack complexity and no user interaction or privileges required, earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). By injecting payloads into the 'sort' parameter, attackers can append malicious SQL queries to legitimate ones, enabling extraction of sensitive database information through time-based blind SQL injection techniques.
Advisories and references, including code snippets from geo-mashup-db.php (lines 1767 and 1785), render-map.php (line 166), changeset 3503627, and Wordfence threat intelligence, highlight the incomplete sanitization in 1.13.18 and point to remediation via proper application of the sanitizer across all affected code paths in subsequent updates. Security practitioners should urge immediate updates to patched versions of the plugin and review sites using Geo Mashup for exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26778
Vulnerability details
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…
more
on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated SQL injection in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications (T1190) and facilitating extraction of data from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates validation and sanitization of user-supplied inputs like the 'sort' parameter to prevent time-based SQL injection in database queries.
Requires identification and timely patching of the SQL injection flaw in the Geo Mashup plugin, including complete application of sanitizers across all code paths.
Enforces restrictions and whitelisting on inputs such as the 'sort' parameter to limit values to safe options, blocking malicious SQL payloads as partially implemented in version 1.13.18.